RPBroker

Note

This authenticator delegates the authentication to a trusted (internal or external) OIDC OP. It authenticates by sending an authentication request to that OP and then validating the id_token. This authenticator currently only supports Authorization Code Flow.

Configuring the authenticator

Before enabling the authenticator ensure that phenix-oidc-discovery module is enabled and that the right OIDC OP has been configured for discovery. This is important and required even if the target OP is internal.

Name	Description	Default value	Mandatory
pipeID	pipe id of the pipe used for id token validation.	N/A	YES
rpID	Internal ID of the OIDC Relying party to use	N/A	YES
usernameAttribute	Value considered as username in the returned item from validation pipe.	sub	YES
scope	The oidc scope sent to the OP (EXPANDABLE)	openid	No
opId	Internal id of the OP to use	N/A	Yes
executeUserInfoLookup	If to perform a user info lookup in addition. Final: OpenID Connect Core 1.0 incorporating errata set 2 Requires the op exposing a user_info url in discovery data. Response from discovery will be sent in to the pipe in parameter "user_info".	false	No
usePKCE	Whether or not to use PKCE	true	No
useNonce	Whether or not to use Nonce	true	No
loginHint	The login_hint sent to the OP (EXPANDABLE)	N/A	No
acrValues	The acr_values sent to the OP (EXPANDABLE)	N/A	No
redirectUrlOverride	An obsolete option kept for backwards compatibility. Overrides the `redirect_uri` to use. For automatic redirect handling, configure your RP to allow the redirect uri: `<your-domain>/authentication/oidcrp/<your-rp-id>/callback`	N/A	No
enableLogout	Whether logout functionality should be enabled. If enabled, logging out at the entrypoint would also send an RP initiated logout to the external OP (if they have an end_session_endpoint in their discovery document).	false	No

Redirect URL and automatic redirecting

PAS 6.0 introduced an upgrade to the RPBroker that allows you to avoid configuring redirect uris to fit your protocol entrypoint, meaning you may configure one static redirect URL that will work no matter where you use it. This redirect URL is automatically added when using the guide scenario, and will always be: <your-domain>/authentication/oidcrp/<your-rp-id>/callback.

Logout functionality has also been added, meaning logging out at your entrypoint will also send an RP initiated logout to the OP (provided they have an end_session_endpoint configured. If you do not wish to use any logout functionality, set enableLogout to false in the RPBroker authenticator configuration.

Changes to previous behavior (before PAS 6.0)

Previous behavior required correct allowed redirects to be configured at the OpenID Provider in a way so the would fit your current URL when you use the authenticator. That behavior has now been changed, and works in the current way:

The RPBroker will look through your configured allowedRedirects at the OIDC_RP
If one of the redirect paths are equal to your current path, this redirect_uri will be used in the outgoing request
If the generic redirect url has been configured (<your-domain>/authentication/oidcrp/<your-rp-id>/callback), that will be used
If no suitable redirect uri has been found in the steps above, an error is thrown.
Note that the parameter redirectUrlOverride is still available, and will override the above options and you may set the URL to what you wish, but it is no longer necessary to use and is not recommended.

Just running through the guide scenario will configure everything you need, so it is recommended to do that.

Example configuration

{
  "id" : "6b216eaa-fd5b-49c2-ae86-f809a348c24e",
  "alias" : "rpbroker",
  "name" : "RPBroker",
  "displayName" : "rpbroker",
  "configuration" : {
    "pipeID" : "bb386174-090e-439b-81bb-ea19be41c6cf",
    "opID" : "my_oidc_op_id_2",
    "rpID" : "broker",
    "usePKCE" : "true",
    "useNonce" : "true",
    "doUserInfoLookup" : "false",
    "usernameAttribute" : "sub", 
    "loginHint" : "{{session.userSource}}",
    "acrValues" : ["myacrValue1", "{{request.myacrValue2}}"]
  },
  "created" : "2023-12-08T09:44:50.897Z"
}

Requirements

The pipe executed MUST respond with one item. The phenix-oidc-discovery module must be enabled so that the OIDC OP's endpoints can be saved and used for the authentication. This is required even if the target OP is internal.

Table of Contents